diff mbox

9pfs: make illegal path name detection more robust

Message ID 57e9f83a.e80d9d0a.89644.0d9f@mx.google.com
State New
Headers show

Commit Message

Li Qiang Sept. 27, 2016, 4:40 a.m. UTC 
From: Li Qiang <liqiang6-s@360.cn>

The parameter of name_is_illegal can be NULL, adding detection of
this to avoid NULL pointer dereference issue.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
 hw/9pfs/9p.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Greg Kurz Sept. 27, 2016, 7:40 a.m. UTC | #1 
On Mon, 26 Sep 2016 21:40:17 -0700
Li Qiang <liq3ea@gmail.com> wrote:

> From: Li Qiang <liqiang6-s@360.cn>
> 
> The parameter of name_is_illegal can be NULL, adding detection of
> this to avoid NULL pointer dereference issue.
> 

Same as with the other patch: the root cause is in v9fs_iov_vunmarshal().

> Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> ---
>  hw/9pfs/9p.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index dd3145c..d960a2e 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -1277,7 +1277,7 @@ static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t nwnames, V9fsQID *qids)
>  
>  static bool name_is_illegal(const char *name)
>  {
> -    return !*name || strchr(name, '/') != NULL;
> +    return !name || !*name || strchr(name, '/') != NULL;
>  }
>  
>  static bool not_same_qid(const V9fsQID *qid1, const V9fsQID *qid2)
diff mbox

Patch

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index dd3145c..d960a2e 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -1277,7 +1277,7 @@  static int v9fs_walk_marshal(V9fsPDU *pdu, uint16_t nwnames, V9fsQID *qids)
 
 static bool name_is_illegal(const char *name)
 {
-    return !*name || strchr(name, '/') != NULL;
+    return !name || !*name || strchr(name, '/') != NULL;
 }
 
 static bool not_same_qid(const V9fsQID *qid1, const V9fsQID *qid2)